CredVault

Secure credential storage with versioning, rotation, and audit logging.

Overview

CredVault is the security layer of AionixOne, providing AWS Secrets Manager-like capabilities for storing and managing sensitive credentials locally with encryption at rest.

TRN Pattern

trn:credvault:{tenant}:credential/{name}
trn:credvault:{tenant}:credential/{name}/version/{version}

Key Features

• Multiple Credential Types — API keys, passwords, certificates, OAuth tokens
• Versioning — Immutable versions with activation/retirement lifecycle
• Rotation — Programmatic rotation with audit logging
• Encryption — AES-256 at rest with master key management
• DSL Integration — Reference via $secret.{name} syntax in workflows

Quick Example

# Create secret
aio sec create db-password --value "super-secret-123"
 
# Create with type
aio sec create github-token \
  --type api-key \
  --value "ghp_xxxx"
 
# Reveal (requires confirmation)
aio sec reveal db-password
 
# Rotate
aio sec rotate db-password --value "new-secret-456"
 
# List versions
aio sec versions db-password

Credential Types

DSL Reference

In StepFlow workflows:

{
  "parameters": {
    "apiKey": "{% $secret.github-token %}",
    "dbPassword": "{% $secret.db-password %}"
  }
}

API Endpoints

Reference Pages

• Credential Types — All credential type documentation
• Versioning — Version lifecycle management
• Rotation — Rotation strategies and automation
• HTTP API — Complete API reference

Documentation in progress. Content will be expanded.